1085 matches found
Easy Appointments <= 3.12.21 - Information Disclosure
Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...
WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure
WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. id: CVE-2022-2373 info: name: WordPress Simply Schedu...
CVE-2026-119515 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a...
WordPress WP BASE Booking of Appointments, Services and Events plugin 6.5.0-6.5.0 - Subscriber+ Privilege Escalation vulnerability
Subscriber+ Privilege Escalation vulnerability discovered by Ryan Fabella in WordPress Plugin WP BASE Booking versions 6.5.0-6.5.0...
CVE-2026-123064
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their...
CVE-2026-123064 WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their...
CVE-2026-123064
The WP BASE Booking of Appointments, Services and Events WordPress plugin (versions prior to 6.5.1 ) contains a privilege escalation vulnerability. The root cause is that the plugin does not properly restrict access to one of its user-creation actions . This allows authenticated users with Subscr...
EUVD-2026-119828
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their...
CVE-2026-123064 WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their...
exploit-CVE-2022-0482
Easy!Appointments PII disclosure Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples: exploit.rb...
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hera-user in WordPress Plugin Radius Booking — Booking Calendar for Appointments & Services versions = 1.0.20...
CVE-2022-0482_exploit
CVE-2022-0482 Vulnerability Exploitation Introduction This document outlines the detailed analysis of CVE-2022-0482, a critical security vulnerability identified in the Easy!Appointments scheduling software. This flaw, related to Incorrect Authorization under CWE-863, allows unauthorized access t...
CVE-2026-119508 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a...
CVE-2026-119508
The Radius Booking — Booking Calendar for Appointments & Services WordPress plugin (versions up to and including 1.0.20 ) is vulnerable to a Broken Access Control flaw. The root cause is a Missing Authorization vulnerability (CWE-862) caused by incorrectly configured access control security level...
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hera-user in WordPress Plugin Radius Booking — Booking Calendar for Appointments & Services versions = 1.0.20...
CVE-2025-29448
CVE-2025-29448 Description booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability. Steps to Reproduce 1. Intercept an appointment booking reques...
CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20...
CVE-2026-119516
The Radius Booking — Booking Calendar for Appointments & Services plugin (by Mamunur Rashid) is vulnerable to PHP Object Injection via the deserialization of untrusted data . This issue affects versions up to and including 1.0.20 . An attacker could potentially exploit this flaw to execute arbitr...
CVE-2025-50383
CVE-2025-50383 Description A low-privileged authenticated user can exploit this vulnerability by sending a crafted HTTP POST request with a malicious orderby parameter e.g., orderby=IF1=1,SLEEP5,1. This can trigger time-based blind SQL injection, resulting in unauthorized SQL execution on the...
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by hhhai in WordPress Plugin Radius Booking — Booking Calendar for Appointments & Services versions = 1.0.20...